Privacy Policy

1. Who We Are

Bucket List Scots is a Scottish history website operated by William Drummond. We are based in Clackmannanshire, Scotland.

We are the data controller for any personal data collected through this website. This means we decide how and why your data is processed.

If you have any questions about this policy or how we handle your data, you can contact us at:

Email: [your email address] Address: [your postal address, if you wish to include it]

2. What Data We Collect

We may collect the following types of personal data when you use our site:

Identity Data — your name or username

Contact Data — your email address

Transaction Data — details of ebook purchases you make (we do not store full payment card details; these are processed securely by a third-party payment provider)

Profile Data — your interests, preferences, and feedback if you choose to provide them (e.g. via the contact form or blog comments)

Technical Data — IP address, browser type and version, time zone setting, operating system, and other technology on the device you use to access our site

Usage Data — information about how you use our website, which pages you visit, and how you interact with content

Marketing & Communications Data — your preferences in receiving email newsletters from us

3. How We Collect Your Data

We collect data in the following ways:

Direct interactions — when you fill in our contact form, sign up for our email newsletter, purchase an ebook, register for the members' blog, or otherwise correspond with us

Automated technologies — Squarespace analytics and cookies collect technical and usage data when you browse our site (see our Cookie Policy for more detail)

Third parties — we may receive technical data from analytics providers such as Squarespace Analytics

4. How We Use Your Data & Our Lawful Bases

Under UK data protection law (UK GDPR and the Data Protection Act 2018), we must have a lawful basis for processing your data. Here is how we use your data and which basis we rely on:

Purpose of Processing Data Used Lawful Basis

To respond to enquiries submitted via our contact form Identity, Contact Legitimate interest — it is in both our and your interest for us to reply to your message

To send you our email newsletter Contact, Marketing Preferences Consent — you actively opt in, and you can withdraw at any time

To process and deliver ebook purchases (including sending download links) Identity, Contact, Transaction Contract — processing is necessary to fulfil your purchase

To administer your members' blog account Identity, Contact, Profile Contract — necessary to provide you with the membership service you signed up for

To improve our website and content Technical, Usage Legitimate interest — to understand how visitors engage with our site and to make it better

To notify you about changes to our terms or this policy Contact Legal obligation — we are required to inform users of material changes

To detect, prevent, and investigate security incidents Technical, Usage Legitimate interest — keeping our site and users safe

5. Email Newsletter — Consent

When you sign up for the Bucket List Scots newsletter, we will ask for your explicit consent via a tick box. You are not required to sign up for the newsletter to purchase ebooks or access other parts of the site.

You can withdraw your consent at any time by clicking the "unsubscribe" link in any newsletter email, or by contacting us directly. Withdrawing consent does not affect the lawfulness of processing carried out before your withdrawal.

6. Data Retention

We will only keep your personal data for as long as necessary to fulfil the purposes we collected it for:

Data Type Retention Period

Contact form enquiries 12 months after your enquiry is resolved

Newsletter subscribers Until you unsubscribe (or until 24 months of inactivity, whichever is sooner)

Ebook purchase records 6 years (to comply with HMRC record-keeping requirements)

Members' blog account data Until you close your account, or after 24 months of inactivity

Analytics / technical data 26 months (via Squarespace)

7. Who We Share Your Data With

We use a small number of trusted third parties to run our website and deliver our services. These are:

Squarespace, Inc. — our website hosting platform and analytics provider (based in the USA; see section 8 on international transfers)

Stripe (or your chosen payment processor) — for processing ebook payments. We do not see or store your full card details

Email service provider (e.g. Mailchimp, Flodesk, or similar) — for sending our newsletter (we will add the specific provider name here)

HMRC / tax authorities — if required by law to retain transaction records

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not sell your personal data to anyone.

8. International Transfers

Squarespace is based in the United States. Where your personal data is transferred to, stored in, or processed in a country outside the UK, we ensure that appropriate safeguards are in place. For Squarespace, this is covered by the International Data Transfer Addendum to the EU SCCs (as required under UK GDPR) or Squarespace's certification under the UK-US Data Bridge.

If you would like more details about the safeguards in place, please contact us.

9. Cookies

Our website uses cookies (small text files stored on your device) to:

Ensure the site functions correctly (necessary cookies)

Collect anonymous analytics about how visitors use the site (Squarespace Analytics)

Remember your preferences

When you first visit our site, you will be asked to consent to non-essential cookies via our cookie banner. You can change your cookie preferences at any time through your browser settings.

For full details, please see our separate Cookie Policy.

10. Your Rights Under UK GDPR

Under UK data protection law, you have the following rights:

Right What This Means

Right to be informed You have the right to be told how we use your data — this policy provides that information

Right of access You can request a copy of the personal data we hold about you (a "subject access request")

Right to rectification You can ask us to correct any inaccurate or incomplete data

Right to erasure ("right to be forgotten") You can ask us to delete your personal data where there is no compelling reason to keep it

Right to restrict processing You can ask us to limit how we use your data in certain circumstances

Right to data portability You can request a copy of your data in a commonly used, machine-readable format

Right to object You can object to processing based on legitimate interests or direct marketing

Rights related to automated decision-making We do not use automated decision-making or profiling that has legal effects on you

To exercise any of these rights, please contact us using the details in section 1. We will respond within one month (extendable to two months for complex requests).

There is no charge for exercising your rights unless your request is clearly unfounded or excessive.

11. Your Right to Complain to the ICO

If you are unhappy with how we handle your personal data, please contact us first — we will do our best to resolve the issue.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection supervisory authority:

Information Commissioner's Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF

Website: www.ico.org.uk Helpline: 0303 123 1113

12. Security

We take the security of your personal data seriously. We have implemented appropriate technical and organisational measures to protect your data against accidental loss, alteration, unauthorised access, or disclosure. These include SSL encryption on our website, limited access to personal data, and secure data storage via Squarespace.

13. Third-Party Links

Our website may contain links to third-party websites (e.g. historical resources, book retailers). We are not responsible for the privacy practices of those websites. We encourage you to read their privacy policies before providing them with your data.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (if we have your contact details) or by a prominent notice on our website. The "Effective Date" at the top of this page will always show when it was last updated.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please get in touch:

Bucket List Scots Clackmannanshire, Scotland

Email: [your email address]

</x-artifact>

A few things you'll need to fill in on this before publishing:

Your email address — add it in sections 1 and 15 so people can reach you

Your postal address (optional) — I've included a placeholder in section 1 if you want it; some people prefer to give just email

Email service provider — update section 7 with the actual service you use for your newsletter (e.g. Mailchimp, MailerLite, Flodesk, etc.)

Cookie Policy — section 9 links to a separate /cookie-policy page. Squarespace has a built-in Cookie Policy generator, or I can write one for you too if you like